Thread by @bellingcat

A GRU spy who sought to gain access to the International Criminal Court as an intern left a long and detailed trail on social media.

bellingcat.com/news/americas/…

Today, Dutch Intelligence (AIVD) said that a man named Sergey Vladimirovich Cherkasov had spent years building up a cover identity as a Brazilian man named “Victor Muller Ferreira” theguardian.com/law/2022/jun/1…

The AIVD said that this man had been refused entry into the Netherlands and sent back to Brazil

A press release from the AIVD provided a wide array of information, including details of his apparent “legend” identity – a fake persona created by the GRU english.aivd.nl/latest/news/20…

The details of his "legend" provided further clues about “Victor Muller Ferreira” and allowed Bellingcat (and other open source researchers) to quickly unravel his digital and real world footprint

Some of the details of his backstory can be seen here:

https://twitter.com/PjotrSauer/status/1537425030526672900?s=20&t=2zkRUK2mEsypGQchjUvDgg

A profile at myviasjobs says he worked as a travel agent in Brazil before attending Trinity College Dublin as an undergraduate where he studied political science (2014-18).

He then got his Master’s at Johns Hopkins’ SAIS programme (2018-20).

"Viktor" had Facebook and Twitter profiles. He also had a blog that focused on geopolitics called Politics Of US. Yet there was little on there that suggested he had any pro-Russian leanings

Interestingly, he once shared a Bellingcat article that revealed the identity of newly uncovered GRU online personas

One of "Victor's" professors at John's Hopkins has commented on his presence in his class and his feelings on discovering his apparent double identity:

https://twitter.com/eugene_finkel/status/1537501602566787074

Information about the true identity of the recent Johns Hopkins graduate is harder to find, but does exist in some leaked Russian databases.

It is worth noting that some of the data that was found in offline databases – such as a passport number and travel history – appears to have been manually removed from other Russian databases and data services, as is typical with security service officers.

Cherkasov is from Kaliningrad and frequently travelled between the European exclave and Moscow by train between 2005 and 2008.

The fact that these train trips are in Cherkasov’s name when he was only 20 points to this being his actual identity, rather than yet another cover persona.

While it is possible that Cherkasov was already working under a false persona at only 20 years old, it is more likely that he was assigned one later in life...

Most GRU officers that Bellingcat has studied over the years did not start working under false cover until their mid-twenties at the earliest bellingcat.com/tag/gru/

Bellingcat was also able to find flights that Cherkasov took in 2015 between Kaliningrad, Moscow and Belgorod.

More information will doubtless surface regarding Cherkasov in the weeks to come as he was not terribly secretive in his digital footprint.

For now, read our full story with further details on how we can tell data about Cherkasov was specifically moved from Russian databases and data services – as is typical with security service officers: bellingcat.com/news/americas/…